GhostMap Android flaw lets a permissionless app put a phone in a boot loop

Bitdefender has published details of an Android flaw it calls GhostMap, which lets a malicious app force a device into a continuous boot loop. The app needs no permissions and doesn't have to be launched. Installing it is enough.

The bug sits in two Android libraries that read ZIP compression methods differently. A malformed APK can slip past size checks and get mapped beyond the file's actual contents. Anything that reads that entry gets a SIGBUS, the signal the CPU sends to stop a process touching invalid memory.

Bitdefender built a demo app with no executable code and a resource that the core service system_server reads automatically after installation. The read crashes the process, it restarts, reads the same resource, and crashes again. On a Pixel 10 running Android 17 with the August 5 security patch, the loop started about a second after install and repeated 110 times in normal boot mode and 72 times in safe mode.

That last part is the awkward bit. Safe Mode is normally how you dig yourself out, and here it doesn't help. The two routes back are a factory reset, which wipes local data, or deleting the malformed file over ADB. ADB only works if debugging was already enabled, and the commands have to land before the system crashes again.

Bitdefender says it reported the issue to Google on August 20 and got a "Won't Fix (Not Reproducible)" reply, with the issue ruled out of scope. An extended report on August 25 was also deemed out of scope for a security update, though Google kept it for consideration in a future release. BleepingComputer asked Google about the fix status and hadn't heard back when it published.

The researchers say the only real chance to block this is at install time. Third-party security tools might flag a suspicious app, but they can't stop the installation.

For defenders, the practical question is whether debugging is enabled on the devices you manage, since that's the difference between a recoverable phone and a wiped one. We'd treat the "not reproducible" closure with some suspicion until Google says more. Nobody has published a working detection method, and the advisory doesn't say whether any real device has been hit.